CVE-2026-87080
Deferred Deferred - Pending Action

Net::IDN::Punycode Decoder Label Truncation Issue

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
2026-09-22
NVD
CVE-2026-87080
EUVD
EUVD-2026-84293

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Net::IDN::Punycode::PP Perl module versions before 2.590. It occurs when decoding truncated Punycode labels, where the decoder incorrectly processes incomplete input instead of rejecting it. The issue stems from a bug in error handling: using substr on an exhausted string returns an empty string, not undef, so the decoder fails to detect the end of input. This causes the decoder to treat end-of-input as a valid code point, inserting a fabricated character into the output.

Detection Guidance

To detect this vulnerability, check if your system uses Net::IDN::Punycode::PP versions before 2.590. Run the command perl -MNet::IDN::Punycode -e 'print $Net::IDN::Punycode::VERSION' to verify the installed version. If the version is below 2.590, the system is vulnerable.

Impact Analysis

This vulnerability can lead to inconsistent decoding of Punycode labels between systems using the pure-Perl backend and those using the XS backend. An attacker could craft a label that resolves to a name on one system but is rejected by another, potentially causing misinterpretation of domain names or unexpected behavior in applications relying on this module.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it relates to a specific implementation flaw in Punycode decoding rather than data protection or privacy controls. However, if exploited, it could enable spoofing attacks by causing inconsistent interpretation of domain names, potentially leading to phishing or impersonation risks that might indirectly impact compliance with security requirements in these regulations.

Mitigation Strategies

Update Net::IDN::Punycode::PP to version 2.590 or later to fix the decoder logic handling truncated labels. Verify the XS backend is used where available to avoid discrepancies between backends.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart